Supplier Concentration Risk: How to Measure and Reduce It

Supplier concentration risk is the exposure you carry when a large share of your spend, or one input you cannot do without, depends on a single supplier or a small group. If that supplier fails, raises prices or cannot ship, you have no quick alternative. The fix is rarely "buy from everyone." It is knowing where dependence is deepest, pricing what a failure would cost, and building a tested exit for the few relationships that could hurt you.

This guide is written for owners, operations leaders and IT decision-makers at small and midsize US companies. It covers what to measure, where concentration hides, and what to do about it at a reasonable cost.

TL;DR

• Concentration risk is dependency risk: the harder a supplier is to replace and the bigger its share of your operations, the more exposed you are.
• Measure it three ways: share of spend, single-source dependency by critical item, and shared upstream or geographic exposure.
• Two suppliers are not always two options. They can rely on the same upstream provider, region or cloud platform.
• Concentration is not automatically bad. Unmanaged concentration in hard-to-replace categories is the problem.
• Treat mitigation as an ongoing practice: rank exposures in dollars, set triggers, and test an exit before you need one.

Table of Contents

• What supplier concentration risk means
• Why it is easy to miss
• How to measure it
• A worked example
• Technology suppliers deserve their own line
• How to reduce supplier concentration risk
• Our perspective
• Where we can help
• A 30-day starting plan
• FAQ
• Sources

What supplier concentration risk means

The same idea goes by several names: single supplier risk, supplier dependency risk, vendor concentration. They describe one situation. Your business leans on too few sources for something it needs.

It shows up in four common forms:

• Single source: one supplier provides a part, ingredient, service or platform.
• Spend concentration: a few suppliers account for most of what you buy.
• Geographic concentration: suppliers sit in the same country, region or port corridor. The U.S.-China Economic and Security Review Commission has documented how the concentration of critical supply chain segments in China leaves the United States exposed in areas such as active pharmaceutical ingredients and rare earth elements.
• Technology concentration: your operations run on one cloud, one software platform or one managed provider.

Some concentration is deliberate and sensible. One main supplier can mean volume pricing, priority during shortages and a vendor who knows your business. Public filings show how common it is: one company's SEC note on supplier concentration reports that its top ten suppliers made up 84%, 83% and 85% of purchases across 2022, 2021 and 2020. Heavy concentration can be a conscious strategy. The question is whether you chose it and priced it.

Why it is easy to miss

Consolidation tends to look good on a spreadsheet. Fewer vendors means fewer invoices, better rates and less management time. A review of the grocery supply chain by the Federal Trade Commission found that companies came to see excessively consolidated supply chains as a liability once the pandemic hit. Efficiency had removed the buffer.

There is also evidence that concentration changes behavior. A 2024 study of 14,562 firm-year observations across 2,692 listed firms found that higher supplier concentration was associated with greater risk-taking by the buying firm. That is a correlation in listed companies, not a law for every small business. But it matches what we see: when a supplier relationship feels smooth, nobody asks what happens if it stops.

How to measure it

You do not need special software to start. You need a supplier list, twelve months of spend and an honest conversation with whoever runs operations.

1. Spend share

Rank suppliers by annual spend and calculate each one's share of total purchases. Then repeat inside each category: your top packaging vendor may be 5% of total spend but 90% of packaging.

There is no universal threshold. Large public companies disclose major suppliers in their financial statement notes, and the cutoffs differ by company. For a small business, a practical rule is to look hard at anyone above roughly a quarter of a category's spend, and at anyone you could not replace within a quarter regardless of share.

2. Single-source dependency

Spend share misses cheap but critical items. A $4,000-a-year component can stop a $4 million line. For each critical product, service or system, record:

• How many approved sources exist
• How long it takes to qualify a new one (testing, certification, contract terms, data migration)
• What a week of interruption costs in lost revenue, overtime and penalties

The qualification time is the number most people lack. A second source that takes nine months to approve is not a second source for a shortage that lasts six weeks.

3. Shared upstream exposure

This is the layer most businesses never map. Two suppliers may look independent but rely on the same tier-two manufacturer, the same port, or the same cloud platform. Research on supply chain dependency, including this review of dependency models in supply chains, notes that individual risks are interconnected, so a single disruption can look like several suppliers failing at once.

Ask each key supplier three questions: where do you make or source this, who are your critical subcontractors, and which hosting or logistics providers could take you offline?

4. Put it in dollars

A risk score of "medium" does not help you decide. Convert each exposure to money:

1. Estimate the revenue or margin at risk per week of disruption.
2. Estimate the likely duration range (a short outage versus a quarter-long shortage).
3. Estimate the cost to prepare: a second source, safety stock, a contract clause, a tested backup.
4. Compare. If preparing costs less than a modest slice of the exposure, act. If not, accept the risk on purpose and write that decision down.

This is also where tariffs matter. A price change on one supplier's country of origin hits you hardest if that supplier is also your only source. Our Enterprise Intelligence Assessment is built around exactly this kind of dollar-based view of supplier and tariff exposure.

A worked example

Take a hypothetical 60-person distributor. The numbers are illustrative, not client data.

By spend, the main product line leads. But look at the packaging row: two suppliers, one plant. On paper it is diversified, in practice it is a single point of failure. And the warehouse software is only 1.6% of the spend shown here, yet an outage costs nearly as much per week as the main line. Spend share alone would have ranked it near the bottom.

The priorities that come out: qualify a second source for the main line, find a packaging supplier in a different region, and confirm that the software vendor allows data export and has a documented recovery process.

Technology suppliers deserve their own line

For many small businesses the most concentrated dependency is not a factory. It is a cloud platform, an identity provider or a managed IT vendor. Regulators have noticed. The Federal Reserve's cybersecurity and financial system resilience report says it expects financial institutions to manage risks tied to their third-party service providers, and that concern extends to how many firms rely on a few technology providers.

A Carnegie Endowment analysis of cloud resilience describes a resilience paradox: the largest providers are often the best at security and also the most systemic single points of failure. You cannot realistically avoid them. You can avoid being unprepared for them.

Practical steps for technology dependence:

• Keep an independent, restorable copy of your critical data outside the primary provider.
• Confirm you can export data in a usable format, and test it once.
• Know which of your own vendors run on the same cloud, so a single outage does not surprise you three times.
• Document who holds admin credentials and where the recovery steps live.

Hardware makers face a version of this too. For electronics teams, a discussion of design for availability makes the point that approved second sources on a bill of materials do not guarantee supply if the alternates share the same constraints. The lesson applies to any industry: a listed alternate is only an alternate if it can actually ship.

How to reduce supplier concentration risk

You have more options than switching vendors. Match the response to the exposure.

One caution from the FTC's pandemic-era findings: real resilience means balancing cost efficiency with intentional diversity, and that carries some added complexity. Budget for it. If a plan promises resilience at zero cost, it is probably moving the risk somewhere you cannot see.

Set triggers, not just targets

Decide in advance what makes you act. Examples: a supplier passes a set share of a category, a financial warning sign appears, lead times lengthen past a set number of weeks, or a tariff change moves landed cost by a set percentage. Triggers turn "we should look at this someday" into a scheduled decision.

Test the exit

Practitioners advocate assuming a supplier will eventually fail and rehearsing the removal. A NIST comment document on supply chain security argues for practical, performance-oriented third-party supplier risk guidance. For your business, that means once a year picking one critical supplier and walking through the loss on paper: who calls whom, what stock covers us, how long until a replacement ships, what do we tell customers. The gaps you find in a two-hour session are cheaper than those you find mid-crisis.

Finance should be in the room. The cost of redundancy, and the cost of the outage it prevents, are both budget questions, and a fractional finance team's efficiency and cost analysis can help you decide which diversification spend is worth it.

Our perspective

We work with small and midsize companies that cannot afford a large internal technology and risk team, so we look at concentration through a practical lens. Three things stand out.

First, most owners know their biggest supplier but cannot name their second-biggest dependency. The hidden ones, a single IT provider, a single cloud account, a single person who holds the credentials, tend to be the ones that hurt.

Second, a risk register full of adjectives is not a plan. Our approach is to put exposure in dollars so that the conversation moves from "this feels risky" to "this costs us $X a week if it stops, and $Y to prepare." Owners can make decisions with that.

Third, ownership matters. Whatever analysis you commission, you should hold the artifacts: the supplier map, the assumptions and the plan, in plain language. A map that lives only in a consultant's head disappears when the engagement ends, which is its own form of concentration.

— jaras

Where we can help

If you want a second set of eyes on your supplier and tariff exposure, our engagement starts with a free technology assessment and ends with a prioritized plain-language plan that you own. For supplier and tariff risk specifically, start with the Enterprise Intelligence Assessment. If the dependence you are worried about sits in your IT stack, our fractional CTO engagements cover cloud, security and vendor decisions without a full-time executive hire.

A 30-day starting plan

1. Week 1: Export twelve months of spend by supplier. Rank by share, overall and by category.
2. Week 2: List your ten most critical inputs and systems. Record sources, qualification time and weekly outage cost.
3. Week 3: Ask your top suppliers about their own subcontractors, regions and hosting. Mark overlaps.
4. Week 4: Pick the three largest dollar exposures. For each, choose a response from the table, assign an owner and set a date and a trigger.

Repeat every quarter, and whenever you add a major supplier, because concentration builds quietly.

FAQ

How do you calculate supplier concentration risk?

Start with each supplier's share of total spend and of spend within its category. Then add single-source status, time to qualify a replacement, and the weekly cost of an interruption. Multiplying likely disruption length by weekly cost gives a dollar exposure you can compare with the cost of preparing.

What is a safe level of dependence on one supplier?

There is no universal number. A commodity you can replace in days tolerates high concentration; a custom part or core software platform does not. Judge by replacement time and outage cost, not share alone.

Is single supplier risk always bad?

No. A single main supplier can offer better pricing, priority service and deeper cooperation. It becomes a problem when it is unmanaged: no backup, no exit plan, no monitoring of the supplier's health, and no one who decided it was acceptable.

How do I find hidden dependencies between suppliers?

Ask key suppliers where they manufacture, who their critical subcontractors are, and what cloud or logistics providers they depend on. Compare answers across suppliers. Matching regions, plants or platforms mean your options are less independent than they look.

Sources

• U.S. Supply Chain Vulnerabilities and Resilience, USCC
• SEC filing: supplier concentration note
• SEC filing: customer and supplier concentration disclosure
• FTC supply chain report
• Supplier concentration and firm risk-taking, ScienceDirect
• A Review of Models for Dependency of Risks
• Federal Reserve cybersecurity and financial system resilience report
• Carnegie Endowment: cloud reassurance framework
• NIST Cybersecurity Framework 2.0 concept paper comments